Improper Authentication in eLabFTW - #VU159637
Published: November 6, 2026
Vulnerability identifier: #VU159637
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to take over another user's eLabFTW account.
The vulnerability exists due to improper email comparison during SAML identity provider login, allowing email collation to bypass authentication checks. A remote authenticated attacker with low privileges can exploit this comparison when SAML login is enabled to access the victim's account without victim interaction.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0